@stigmer/sdk 3.26.0 → 3.27.0

package/iam-principal.js

@@ -0,0 +1,73 @@
+/**
+ * Who an IAM policy grants a role to: a person or a team, in one shape a
+ * client builds grants from and reads access lists back into.
+ *
+ * The wire spells a grantee as an `ApiResourceRef`: a person is
+ * `identity_account:<id>` with no relation qualifier, a team is
+ * `team:<id>#member` (every member of the team holds the grant). This
+ * module is the one place in the SDK that knows that spelling, so no caller
+ * writes the qualifier by hand and no caller can drop it.
+ *
+ * Reading goes through the same module: `granteeFromView` turns an access
+ * list entry back into a `Grantee` and answers `undefined` for anything it
+ * does not recognise (another kind, a team with a qualifier other than
+ * `member`), so a client never acts on a principal it would misname. A
+ * revoke built from the returned grantee names the exact row the list
+ * showed, because the server's revoke matches the qualifier exactly.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceRefSchema, } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+const PERSON_KIND = ApiResourceKind[ApiResourceKind.identity_account];
+const TEAM_KIND = ApiResourceKind[ApiResourceKind.team];
+/** The relation that makes every member of a team the grantee. */
+const TEAM_MEMBERS_RELATION = "member";
+/** A person, by identity account id (`ida_...`). */
+export function personGrantee(id) {
+    return { kind: "identity_account", id };
+}
+/** A team, by team id (`tm_...`). */
+export function teamGrantee(id) {
+    return { kind: "team", id };
+}
+/**
+ * The `ApiResourceRef` an IAM policy spec names the grantee with: a person
+ * unqualified, a team as its members.
+ */
+export function granteeRef(grantee) {
+    switch (grantee.kind) {
+        case "identity_account":
+            return create(ApiResourceRefSchema, { kind: PERSON_KIND, id: grantee.id });
+        case "team":
+            return create(ApiResourceRefSchema, {
+                kind: TEAM_KIND,
+                id: grantee.id,
+                relation: TEAM_MEMBERS_RELATION,
+            });
+        default: {
+            const unreachable = grantee;
+            return unreachable;
+        }
+    }
+}
+/**
+ * The grantee an access-list entry names, or `undefined` when the entry
+ * is not a person or a team's members (a structural principal, a kind this
+ * SDK does not know, or a team qualifier other than `member`).
+ */
+export function granteeFromView(view) {
+    if (!view.id)
+        return undefined;
+    if (view.kind === PERSON_KIND && view.relation === "") {
+        return personGrantee(view.id);
+    }
+    if (view.kind === TEAM_KIND && view.relation === TEAM_MEMBERS_RELATION) {
+        return teamGrantee(view.id);
+    }
+    return undefined;
+}
+/** A stable key for a grantee: its kind and id. */
+export function granteeKey(grantee) {
+    return `${grantee.kind}:${grantee.id}`;
+}
+//# sourceMappingURL=iam-principal.js.map

package/iam-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-principal.js","sourceRoot":"","sources":["../src/iam-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAEL,oBAAoB,GACrB,MAAM,qDAAqD,CAAC;AAE7D,MAAM,WAAW,GAAG,eAAe,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACtE,MAAM,SAAS,GAAG,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAUvC,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,kBAAkB;YACrB,OAAO,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,oBAAoB,EAAE;gBAClC,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,qBAAqB;aAChC,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,OAAO,CAAC;YACnC,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA0D;IAE1D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACvE,OAAO,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC"}

package/index.d.ts

@@ -6,7 +6,8 @@ export { MAX_ALLOWED_ORIGINS, LINK_TOKEN_PARAM, validateOrigin, chatPath, buildC
 export { StigmerError, type ErrorCode, isNotFound, isUnauthenticated, isPermissionDenied, isRetryable, isUnimplemented, type ErrorCategory, isConnectError, classifyError, isRetryableError, isTransientStreamError, getUserMessage, type ErrorReason, getErrorReason, type RpcErrorMetadata, annotateRpcError, getRpcMetadata, } from "./errors.js";
 export { type DeploymentMode, deploymentModeOf, isResourceAvailable, } from "./resource-availability.js";
 export { ensureMyIdentityAccount, type EnsuredIdentityAccount, type EnsureMyIdentityAccountOptions, type IdentityAccountLane, } from "./ensure-identity-account.js";
-export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, } from "./authorization-config.js";
+export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, getTeamGrantableRoles, hasTeamGrantableRoles, isRoleTeamGrantable, } from "./authorization-config.js";
+export { type Grantee, type GranteeKind, personGrantee, teamGrantee, granteeRef, granteeFromView, granteeKey, } from "./iam-principal.js";
 export { iamRoleToString, iamRoleFromString, iamRoleDisplayName, iamRoleDescription, } from "./iam-role.js";
 export { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 export { ActivityClient, type ListRecentActivityParams, type ListRecentActivityResponse, } from "./activity.js";
@@ -32,6 +33,7 @@ export { IamPolicyClient, type IamPolicyInput, type ApiResourceRefInput, } from
 export { IdentityAccountClient, toIdentityAccountUpdateInput, type IdentityAccountInput, } from "./gen/identityaccount.js";
 export { InvitationClient, type InvitationInput } from "./gen/invitation.js";
 export { IdentityProviderClient, toIdentityProviderUpdateInput, type IdentityProviderInput, } from "./gen/identityprovider.js";
+export { TeamClient, toTeamUpdateInput, type TeamInput, } from "./gen/team.js";
 export { OAuthAppClient, toOAuthAppUpdateInput, type OAuthAppInput, } from "./gen/oauthapp.js";
 export { McpServerClient, buildMcpServerProto, toMcpServerUpdateInput, type McpServerInput, type StdioServerConfigInput, type HttpServerConfigInput, type ToolApprovalPolicyInput, } from "./gen/mcpserver.js";
 export { MemoryClient, buildMemoryProto, toMemoryUpdateInput, type MemoryInput, type MemoryProvenanceInput, } from "./gen/memory.js";

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,KAAK,aAAa,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,KAAK,WAAW,EAChB,cAAc,EACd,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,cAAc,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EACL,eAAe,EACf,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,KAAK,aAAa,EAClB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,KAAK,WAAW,EAChB,cAAc,EACd,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,cAAc,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,uBAAuB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,aAAa,EACb,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAGpE,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,mBAAmB,IAAI,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGrF,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,6BAA6B,GACnC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,YAAY,EACZ,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,IAAI,EACT,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,0BAA0B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,oBAAoB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,KAAK,SAAS,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EACL,UAAU,EACV,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC"}

package/index.js

@@ -16,7 +16,8 @@ export { deploymentModeOf, isResourceAvailable, } from "./resource-availability.
 // platform builders' own gates).
 export { ensureMyIdentityAccount, } from "./ensure-identity-account.js";
 // Authorization config and IAM role utilities
-export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, } from "./authorization-config.js";
+export { getGrantableRoles, hasGrantableRoles, isRoleGrantable, getTeamGrantableRoles, hasTeamGrantableRoles, isRoleTeamGrantable, } from "./authorization-config.js";
+export { personGrantee, teamGrantee, granteeRef, granteeFromView, granteeKey, } from "./iam-principal.js";
 export { iamRoleToString, iamRoleFromString, iamRoleDisplayName, iamRoleDescription, } from "./iam-role.js";
 export { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 // Activity client (unified recents)
@@ -52,6 +53,7 @@ export { IamPolicyClient, } from "./gen/iampolicy.js";
 export { IdentityAccountClient, toIdentityAccountUpdateInput, } from "./gen/identityaccount.js";
 export { InvitationClient } from "./gen/invitation.js";
 export { IdentityProviderClient, toIdentityProviderUpdateInput, } from "./gen/identityprovider.js";
+export { TeamClient, toTeamUpdateInput, } from "./gen/team.js";
 export { OAuthAppClient, toOAuthAppUpdateInput, } from "./gen/oauthapp.js";
 export { McpServerClient, buildMcpServerProto, toMcpServerUpdateInput, } from "./gen/mcpserver.js";
 export { MemoryClient, buildMemoryProto, toMemoryUpdateInput, } from "./gen/memory.js";

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,mBAAmB;AACnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,iBAAiB;AACjB,OAAO,EAGL,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAK7B,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,iBAAiB;AACjB,OAAO,EACL,YAAY,EAEZ,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EAEf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EAEd,cAAc,EAEd,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,OAAO,EAEL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EACL,uBAAuB,GAIxB,MAAM,8BAA8B,CAAC;AAEtC,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,oCAAoC;AACpC,OAAO,EACL,cAAc,GAGf,MAAM,eAAe,CAAC;AAGvB,iBAAiB;AACjB,OAAO,EACL,aAAa,GAQd,MAAM,cAAc,CAAC;AAEtB,mDAAmD;AACnD,OAAO,EACL,oBAAoB,GAMrB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,gBAAgB;AAChB,OAAO,EACL,YAAY,EAGZ,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,sBAAsB;AACtB,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oDAAoD;AACpD,OAAO,EAAE,cAAc,EAAmB,MAAM,eAAe,CAAC;AAEhE,uDAAuD;AACvD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,qBAAqB,CAAC;AAa7B,6DAA6D;AAC7D,wEAAwE;AACxE,yEAAyE;AACzE,sDAAsD;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,GAOnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAK5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAwB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GAKvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAE5B,MAAM,yBAAyB,CAAC;AACjC,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EACL,UAAU,GAKX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,GAMrB,MAAM,kBAAkB,CAAC;AAE1B,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,uFAAuF;AACvF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,GAQjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,YAAY,EAA4C,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,cAAc,EACd,qBAAqB,GAMtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAE9B,mBAAmB;AACnB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,iBAAiB;AACjB,OAAO,EAGL,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAK7B,4EAA4E;AAC5E,OAAO,EACL,eAAe,EACf,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,iBAAiB;AACjB,OAAO,EACL,YAAY,EAEZ,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,eAAe,EAEf,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EAEd,cAAc,EAEd,gBAAgB,EAChB,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,+CAA+C;AAC/C,OAAO,EAEL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AAEpC,8EAA8E;AAC9E,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EACL,uBAAuB,GAIxB,MAAM,8BAA8B,CAAC;AAEtC,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,aAAa,EACb,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,oCAAoC;AACpC,OAAO,EACL,cAAc,GAGf,MAAM,eAAe,CAAC;AAGvB,iBAAiB;AACjB,OAAO,EACL,aAAa,GAQd,MAAM,cAAc,CAAC;AAEtB,mDAAmD;AACnD,OAAO,EACL,oBAAoB,GAMrB,MAAM,sBAAsB,CAAC;AAE9B,gEAAgE;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,gBAAgB;AAChB,OAAO,EACL,YAAY,EAGZ,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,sBAAsB;AACtB,OAAO,EACL,YAAY,GAKb,MAAM,aAAa,CAAC;AAErB,oDAAoD;AACpD,OAAO,EAAE,cAAc,EAAmB,MAAM,eAAe,CAAC;AAEhE,uDAAuD;AACvD,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,aAAa,EACb,0BAA0B,EAC1B,0BAA0B,EAC1B,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GAKxB,MAAM,qBAAqB,CAAC;AAa7B,6DAA6D;AAC7D,wEAAwE;AACxE,yEAAyE;AACzE,sDAAsD;AACtD,OAAO,EACL,WAAW,EACX,eAAe,EACf,kBAAkB,GAOnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAK5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,GAEvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAwB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,UAAU,EACV,iBAAiB,GAElB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,qBAAqB,GAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GAKvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAE5B,MAAM,yBAAyB,CAAC;AACjC,sEAAsE;AACtE,qEAAqE;AACrE,0EAA0E;AAC1E,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EACL,UAAU,GAKX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,aAAa,EACb,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,oBAAoB,GAMrB,MAAM,kBAAkB,CAAC;AAE1B,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,uFAAuF;AACvF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,GAQjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,YAAY,EAA4C,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,cAAc,EACd,qBAAqB,GAMtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/sdk",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "description": "Stigmer TypeScript SDK — typed API client for all Stigmer platform resources",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,6 +41,6 @@
   "peerDependencies": {
     "@bufbuild/protobuf": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@stigmer/protos": "3.26.0"
+    "@stigmer/protos": "3.27.0"
   }
 }

package/src/__tests__/iam-principal.test.ts

@@ -0,0 +1,82 @@
+/**
+ * Pins the grantee vocabulary (`iam-principal.ts`) and the team half of the
+ * authorization config (`authorization-config.ts`):
+ *
+ *   - a team is always granted as `team:<id>#member` and a person always
+ *     unqualified, because the server's revoke matches the qualifier
+ *     exactly and a dropped `#member` revokes nothing while reporting
+ *     success;
+ *   - reading an access-list entry back is the inverse of building one,
+ *     and anything else (a structural principal, another team qualifier)
+ *     is refused rather than guessed at;
+ *   - a team may only ever be offered a subset of a person's roles, never
+ *     `owner`, and nothing on `organization` (the circular grant the
+ *     model's membership bound forbids).
+ */
+import { describe, expect, it } from "vitest";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+import {
+  getGrantableRoles,
+  getTeamGrantableRoles,
+  hasTeamGrantableRoles,
+  isRoleTeamGrantable,
+} from "../authorization-config";
+import { TEAM_GRANTABLE_ROLES } from "../gen/authorization-config";
+import {
+  granteeFromView,
+  granteeRef,
+  personGrantee,
+  teamGrantee,
+} from "../iam-principal";
+
+describe("granteeRef — the one spelling of a grantee on the wire", () => {
+  it("names a team as its members", () => {
+    const ref = granteeRef(teamGrantee("tm_sre"));
+    expect([ref.kind, ref.id, ref.relation]).toEqual(["team", "tm_sre", "member"]);
+  });
+
+  it("names a person with no relation qualifier", () => {
+    const ref = granteeRef(personGrantee("ida_alice"));
+    expect([ref.kind, ref.id, ref.relation]).toEqual(["identity_account", "ida_alice", ""]);
+  });
+});
+
+describe("granteeFromView — reading an access-list entry back", () => {
+  it("round-trips both grantees through their wire reference", () => {
+    for (const grantee of [teamGrantee("tm_sre"), personGrantee("ida_alice")]) {
+      expect(granteeFromView(granteeRef(grantee))).toEqual(grantee);
+    }
+  });
+
+  it("refuses what it would misname: a team without its members qualifier, a qualified person, a structural principal, an empty id", () => {
+    expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "" })).toBeUndefined();
+    expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "maintainer" })).toBeUndefined();
+    expect(granteeFromView({ kind: "identity_account", id: "ida_alice", relation: "member" })).toBeUndefined();
+    expect(granteeFromView({ kind: "organization", id: "acme", relation: "" })).toBeUndefined();
+    expect(granteeFromView({ kind: "identity_account", id: "", relation: "" })).toBeUndefined();
+  });
+});
+
+describe("team grantable roles", () => {
+  it("are, for every kind, a subset of the person's roles and never owner", () => {
+    for (const [kind, teamRoles] of TEAM_GRANTABLE_ROLES) {
+      const personRoles = getGrantableRoles(kind);
+      for (const role of teamRoles) {
+        expect(personRoles).toContain(role);
+        expect(role).not.toBe(IamRole.owner);
+      }
+    }
+  });
+
+  it("list nothing on organization, so an organization is never shared with a team", () => {
+    expect(hasTeamGrantableRoles(ApiResourceKind.organization)).toBe(false);
+    expect(getTeamGrantableRoles(ApiResourceKind.organization)).toEqual([]);
+  });
+
+  it("answer per role on a kind a team may be shared", () => {
+    expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.viewer)).toBe(true);
+    expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.owner)).toBe(false);
+  });
+});

package/src/authorization-config.ts

@@ -1,6 +1,20 @@
+/**
+ * Which roles a caller may grant on a resource kind, read from the
+ * proto-generated authorization config, so a client offers exactly the
+ * grants the server's `ValidateGrantableRole` step accepts.
+ *
+ * Two grantees, two tables: a person may be granted any role in
+ * `GRANTABLE_ROLES`; a team (Enterprise and Cloud) only the roles in
+ * `TEAM_GRANTABLE_ROLES`, always a subset of the person's. Each table has
+ * the same three readers, so a caller asks the team question with the
+ * same shape it asks the person one.
+ */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-import { GRANTABLE_ROLES } from "./gen/authorization-config.js";
+import {
+  GRANTABLE_ROLES,
+  TEAM_GRANTABLE_ROLES,
+} from "./gen/authorization-config.js";
 
 const EMPTY_ROLES: readonly IamRole[] = Object.freeze([]);
 
@@ -40,3 +54,36 @@ export function isRoleGrantable(
   const roles = GRANTABLE_ROLES.get(kind);
   return roles !== undefined && roles.includes(role);
 }
+
+/**
+ * Returns the roles a team may be granted on the given resource kind.
+ *
+ * An empty array means the kind cannot be shared with a team. Whether the
+ * connected edition serves teams at all is a separate question, answered
+ * by `isResourceAvailable(ApiResourceKind.team, mode)`.
+ */
+export function getTeamGrantableRoles(
+  kind: ApiResourceKind,
+): readonly IamRole[] {
+  return TEAM_GRANTABLE_ROLES.get(kind) ?? EMPTY_ROLES;
+}
+
+/**
+ * Whether the given resource kind can be shared with a team at all.
+ */
+export function hasTeamGrantableRoles(kind: ApiResourceKind): boolean {
+  const roles = TEAM_GRANTABLE_ROLES.get(kind);
+  return roles !== undefined && roles.length > 0;
+}
+
+/**
+ * Whether a team may be granted the given role on the given resource kind
+ * — the team arm of the backend's `ValidateGrantableRole` step.
+ */
+export function isRoleTeamGrantable(
+  kind: ApiResourceKind,
+  role: IamRole,
+): boolean {
+  const roles = TEAM_GRANTABLE_ROLES.get(kind);
+  return roles !== undefined && roles.includes(role);
+}

package/src/gen/authorization-config.ts

@@ -17,6 +17,7 @@ export const GRANTABLE_ROLES: ReadonlyMap<ApiResourceKind, readonly IamRole[]> =
   [ApiResourceKind.identity_provider, [IamRole.owner, IamRole.viewer]],
   [ApiResourceKind.oauth_app, [IamRole.owner, IamRole.viewer]],
   [ApiResourceKind.platform_client, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.team, [IamRole.member]],
   [ApiResourceKind.organization, [IamRole.owner, IamRole.admin, IamRole.member, IamRole.viewer]],
   [ApiResourceKind.agent, [IamRole.owner, IamRole.viewer]],
   [ApiResourceKind.session, [IamRole.owner, IamRole.viewer]],
@@ -34,3 +35,26 @@ export const GRANTABLE_ROLES: ReadonlyMap<ApiResourceKind, readonly IamRole[]> =
   [ApiResourceKind.schedule, [IamRole.owner, IamRole.viewer]],
   [ApiResourceKind.plugin, [IamRole.owner, IamRole.viewer]],
 ]);
+
+/**
+ * Roles that can be granted on each resource kind to a team, so every
+ * member of the team holds the role.
+ *
+ * Source of truth: api_resource_kind.proto — team_grantable_roles in each
+ * kind's AuthorizationConfig, always a subset of grantable_roles.
+ *
+ * Kinds not in this map cannot be shared with a team. Teams are served by
+ * the Enterprise and Cloud editions.
+ */
+export const TEAM_GRANTABLE_ROLES: ReadonlyMap<ApiResourceKind, readonly IamRole[]> = new Map([
+  [ApiResourceKind.agent, [IamRole.viewer]],
+  [ApiResourceKind.skill, [IamRole.viewer]],
+  [ApiResourceKind.mcp_server, [IamRole.viewer]],
+  [ApiResourceKind.agent_instance, [IamRole.viewer]],
+  [ApiResourceKind.agent_channel, [IamRole.viewer, IamRole.participant]],
+  [ApiResourceKind.workflow, [IamRole.viewer]],
+  [ApiResourceKind.workflow_instance, [IamRole.viewer]],
+  [ApiResourceKind.workflow_execution, [IamRole.viewer]],
+  [ApiResourceKind.schedule, [IamRole.viewer]],
+  [ApiResourceKind.plugin, [IamRole.viewer]],
+]);

package/src/gen/client.ts

@@ -27,6 +27,7 @@ import { ScheduleClient } from "./schedule.js";
 import { SessionClient } from "./session.js";
 import { SkillClient } from "./skill.js";
 import { SubscriptionClient } from "./subscription.js";
+import { TeamClient } from "./team.js";
 import { WorkflowClient } from "./workflow.js";
 import { WorkflowExecutionClient } from "./workflowexecution.js";
 import { WorkflowInstanceClient } from "./workflowinstance.js";
@@ -59,6 +60,7 @@ export class GeneratedClient {
   readonly session: SessionClient;
   readonly skill: SkillClient;
   readonly subscription: SubscriptionClient;
+  readonly team: TeamClient;
   readonly workflow: WorkflowClient;
   readonly workflowExecution: WorkflowExecutionClient;
   readonly workflowInstance: WorkflowInstanceClient;
@@ -90,6 +92,7 @@ export class GeneratedClient {
     this.session = new SessionClient(transport);
     this.skill = new SkillClient(transport);
     this.subscription = new SubscriptionClient(transport);
+    this.team = new TeamClient(transport);
     this.workflow = new WorkflowClient(transport);
     this.workflowExecution = new WorkflowExecutionClient(transport);
     this.workflowInstance = new WorkflowInstanceClient(transport);
@@ -149,6 +152,8 @@ export { SkillClient } from "./skill.js";
 export { type SkillInput } from "./skill.js";
 export { SubscriptionClient } from "./subscription.js";
 export { type SubscriptionInput } from "./subscription.js";
+export { TeamClient } from "./team.js";
+export { type TeamInput } from "./team.js";
 export { WorkflowClient } from "./workflow.js";
 export { type WorkflowInput, type WorkflowDocumentInput, type WorkflowTaskInput, type ExportInput, type FlowControlInput, type WorkflowBudgetInput } from "./workflow.js";
 export { WorkflowExecutionClient } from "./workflowexecution.js";

package/src/gen/resource-availability.ts

@@ -20,6 +20,7 @@ export const KIND_TIERS: ReadonlyMap<ApiResourceKind, ResourceTier> = new Map([
   [ApiResourceKind.identity_provider, ResourceTier.enterprise],
   [ApiResourceKind.oauth_app, ResourceTier.open_source],
   [ApiResourceKind.platform_client, ResourceTier.open_source],
+  [ApiResourceKind.team, ResourceTier.enterprise],
   [ApiResourceKind.organization, ResourceTier.open_source],
   [ApiResourceKind.platform, ResourceTier.enterprise],
   [ApiResourceKind.agent, ResourceTier.open_source],

package/src/gen/team.ts

@@ -0,0 +1,132 @@
+// Code generated by stigmer-codegen. DO NOT EDIT.
+
+import { wrapError } from "./errors.js";
+import { stripUndefined } from "./proto-utils.js";
+import { type DeleteResourceInput, type ResourceRef } from "./types.js";
+import { create } from "@bufbuild/protobuf";
+import { createClient, type Client, type Transport } from "@connectrpc/connect";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { TeamSchema, type Team } from "@stigmer/protos/ai/stigmer/iam/team/v1/api_pb";
+import { TeamCommandController } from "@stigmer/protos/ai/stigmer/iam/team/v1/command_pb";
+import { ListTeamsByOrgInputSchema, TeamsSchema, type ListTeamsByOrgInput, type Teams } from "@stigmer/protos/ai/stigmer/iam/team/v1/io_pb";
+import { TeamQueryController } from "@stigmer/protos/ai/stigmer/iam/team/v1/query_pb";
+import { TeamSpecSchema } from "@stigmer/protos/ai/stigmer/iam/team/v1/spec_pb";
+
+/** Provides operations on team resources. */
+export class TeamClient {
+  private readonly command: Client<typeof TeamCommandController>;
+  private readonly query: Client<typeof TeamQueryController>;
+
+  constructor(transport: Transport) {
+    this.command = createClient(TeamCommandController, transport);
+    this.query = createClient(TeamQueryController, transport);
+  }
+
+  async create(input: TeamInput): Promise<Team> {
+    try {
+      return await this.command.create(buildTeamProto(input));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async update(input: TeamInput): Promise<Team> {
+    try {
+      return await this.command.update(buildTeamProto(input));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async delete(input: DeleteResourceInput): Promise<Team> {
+    try {
+      return await this.command.delete(create(ApiResourceDeleteInputSchema, {
+        resourceId: input.resourceId,
+        versionMessage: input.versionMessage,
+        force: input.force,
+      }));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async get(id: string): Promise<Team> {
+    try {
+      return await this.query.get(create(ApiResourceIdSchema, { value: id }));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getByReference(ref: ResourceRef): Promise<Team> {
+    try {
+      return await this.query.getByReference(create(ApiResourceReferenceSchema, { ...ref, kind: ApiResourceKind.team }));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async listByOrg(input: ListTeamsByOrgInput): Promise<Teams> {
+    try {
+      return await this.query.listByOrg(input);
+    } catch (e) { throw wrapError(e); }
+  }
+}
+
+/** Input for creating/updating a Team. */
+export interface TeamInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
+  name: string;
+  slug?: string;
+  org: string;
+  labels?: Record<string, string>;
+  visibility?: ApiResourceVisibility;
+  description?: string;
+}
+
+export function buildTeamProto(input: TeamInput): Team {
+  return Object.assign(create(TeamSchema), {
+    apiVersion: "iam.stigmer.ai/v1",
+    kind: "Team",
+    metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
+      name: input.name,
+      org: input.org,
+      ...(input.slug && { slug: input.slug }),
+      ...(input.labels && { labels: input.labels }),
+      ...(input.visibility && { visibility: input.visibility }),
+    }),
+    spec: Object.assign(create(TeamSpecSchema), stripUndefined({
+      description: input.description,
+    })),
+  }) as Team;
+}
+
+/**
+ * Maps a fetched {@link Team} to a complete {@link TeamInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toTeamUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toTeamUpdateInput(resource: Team): TeamInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(TeamSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    description: spec.description || undefined,
+  };
+}

package/src/iam-principal.ts

@@ -0,0 +1,92 @@
+/**
+ * Who an IAM policy grants a role to: a person or a team, in one shape a
+ * client builds grants from and reads access lists back into.
+ *
+ * The wire spells a grantee as an `ApiResourceRef`: a person is
+ * `identity_account:<id>` with no relation qualifier, a team is
+ * `team:<id>#member` (every member of the team holds the grant). This
+ * module is the one place in the SDK that knows that spelling, so no caller
+ * writes the qualifier by hand and no caller can drop it.
+ *
+ * Reading goes through the same module: `granteeFromView` turns an access
+ * list entry back into a `Grantee` and answers `undefined` for anything it
+ * does not recognise (another kind, a team with a qualifier other than
+ * `member`), so a client never acts on a principal it would misname. A
+ * revoke built from the returned grantee names the exact row the list
+ * showed, because the server's revoke matches the qualifier exactly.
+ */
+import { create } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceRefView } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import {
+  type ApiResourceRef,
+  ApiResourceRefSchema,
+} from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
+
+const PERSON_KIND = ApiResourceKind[ApiResourceKind.identity_account];
+const TEAM_KIND = ApiResourceKind[ApiResourceKind.team];
+
+/** The relation that makes every member of a team the grantee. */
+const TEAM_MEMBERS_RELATION = "member";
+
+/** A person or a team an IAM policy can grant a role to. */
+export type Grantee =
+  | { readonly kind: "identity_account"; readonly id: string }
+  | { readonly kind: "team"; readonly id: string };
+
+/** The kind of a {@link Grantee}. */
+export type GranteeKind = Grantee["kind"];
+
+/** A person, by identity account id (`ida_...`). */
+export function personGrantee(id: string): Grantee {
+  return { kind: "identity_account", id };
+}
+
+/** A team, by team id (`tm_...`). */
+export function teamGrantee(id: string): Grantee {
+  return { kind: "team", id };
+}
+
+/**
+ * The `ApiResourceRef` an IAM policy spec names the grantee with: a person
+ * unqualified, a team as its members.
+ */
+export function granteeRef(grantee: Grantee): ApiResourceRef {
+  switch (grantee.kind) {
+    case "identity_account":
+      return create(ApiResourceRefSchema, { kind: PERSON_KIND, id: grantee.id });
+    case "team":
+      return create(ApiResourceRefSchema, {
+        kind: TEAM_KIND,
+        id: grantee.id,
+        relation: TEAM_MEMBERS_RELATION,
+      });
+    default: {
+      const unreachable: never = grantee;
+      return unreachable;
+    }
+  }
+}
+
+/**
+ * The grantee an access-list entry names, or `undefined` when the entry
+ * is not a person or a team's members (a structural principal, a kind this
+ * SDK does not know, or a team qualifier other than `member`).
+ */
+export function granteeFromView(
+  view: Pick<ApiResourceRefView, "kind" | "id" | "relation">,
+): Grantee | undefined {
+  if (!view.id) return undefined;
+  if (view.kind === PERSON_KIND && view.relation === "") {
+    return personGrantee(view.id);
+  }
+  if (view.kind === TEAM_KIND && view.relation === TEAM_MEMBERS_RELATION) {
+    return teamGrantee(view.id);
+  }
+  return undefined;
+}
+
+/** A stable key for a grantee: its kind and id. */
+export function granteeKey(grantee: Grantee): string {
+  return `${grantee.kind}:${grantee.id}`;
+}